On April 9, 2020, U.S. Department of Health and Human Services (“HHS”) issued a Notification of Enforcement Discretion (the “Notification”) regarding certain covered entities and business associates who choose to participate in the operation of a Community-Based Testing Site (“CBTS”) during the COVID-19 nationwide public health emergency. The Notification relaxes HHS’s enforcement of certain provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). More specifically, HHS will not impose penalties against covered health care providers and their business associates for violations of the HIPAA Privacy, Security, and Breach Notification Rules related to the “good faith participation” in a CBTS. The Notification is effective immediately but applies retroactively to March 13, 2020.

For the purpose of the Notification, a CBTS includes “mobile, drive-through, or walk-up testing sites that only provide COVID-19 specimen collection or testing services to the public.” Operation of a CBTS encompasses “all activities that support the collection of specimens from individuals for COVID-19 testing.”

Under the Notification, HHS’s enforcement discretion will apply only to covered health care providers and their business associates regarding activities connected to the operation of a CBTS. The Notification does not apply to non-CBTS activities performed by covered health care providers or their business associates. As such, there is still potential HIPAA liability for all other HIPAA-covered actions, unless otherwise determined by HHS. In addition, the Notification does not apply to health plans and health care clearinghouses when they are conducting health plan and clearinghouse operations. If a covered entity acts as both a health plan and health care provider, the Notification will apply only when the entity is acting in its role as a health care provider, and then only to the extent that it is participating in a CBTS.

Although covered health care providers and their business associates will not face penalties for HIPAA violations connected to the good faith operation of a CBTS, HHS still encourages them to implement reasonable safeguards for the privacy and security of individuals’ protected health information (“PHI”). According to the Notification, reasonable safeguards include:

  • Using and disclosing only the minimum PHI necessary except when disclosing PHI for treatment;
  • Setting up canopies or similar opaque barriers at a CBTS to provide some privacy to individuals during the collection of samples;
  • Controlling foot and car traffic to create adequate distancing at the point of services to minimize the ability of persons to see or overhear screening interactions at a CBTS — a six foot distance would service this purpose as well as supporting recommended social distancing measures to minimize the risk of spreading COVID-19;
  • Establishing a “buffer zone” to prevent members of the media or public from observing or filming individuals who approach a CBTS, and posting signs prohibiting filming;
  • Using secure technology at a CBTS to record and transmit electronic PHI;
  • Posting a Notice of Privacy Practices (“NPP”) or information about how to find the NPP online, if applicable, in a place that is readily viewable by individuals who approach a CBTS.